Security Advisory

CVE-2026-56385

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-06-21 13:27:01

Last updated 2026-06-22 12:18:10

Assigner VulnCheck

CVSS score 5.3

State PUBLISHED

Description

Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. The action does not enforce per-asset view authorization before returning preview content, allowing an authenticated low-privileged user to supply a controlled assetId for an asset they are not permitted to view and still receive preview response data (previewHtml), including a private preview image route containing the target private assetId. Fixed in 5.9.14 and 4.17.8.

← Browse all CVEs View on cve.org ↗